2026湾区杯决赛（AI专项赛道静态题wp）

#pickle.dump即可保存
pickle.dump(data, file)

#pickle.load即可加载
loaded_data = pickle.load(file)

python -m pickletools tfidf_vectorizer.pkl

analyzer = word
lowercase = True
token_pattern = (?u)\b\w\w+\b
max_df = 0.9
max_features = 100000
ngram_range = (1, 1)

python -m pickletools sentiment_model.pkl

penalty = l2
C = 100000000
random_state = 42
solver = lbfgs
max_iter = 100

         原始文本
            │
            ▼
tfidf_vectorizer.pkl
  TfidfVectorizer
            │
            │ 6799维
            ▼
  [x0,x1,...,x6798]
            │
            ▼
 sentiment_model.pkl
LogisticRegression
            │
            ▼
         0 / 1

     TF-IDF
       
word → index
       │
       │
       ▼
     index
       │
       ▼
 LogisticRegression

index → weight

import joblib
import numpy as np
model = joblib.load("sentiment_model.pkl")

coef = model.coef_[0]

print("min =", coef.min())
print("max =", coef.max())
print("mean =", coef.mean())
print("median =", np.median(coef))
print("std =", coef.std())

import joblib
import numpy as np

model = joblib.load("sentiment_model.pkl")

coef = model.coef_[0]
idx = np.argmax(coef)

print(idx)
print(coef[idx])

import joblib

vectorizer = joblib.load("tfidf_vectorizer.pkl")
for word, index in vectorizer.vocabulary_.items():
    if index == 170:
        print(word)

import joblib
import numpy as np

model = joblib.load("sentiment_model.pkl")
vectorizer = joblib.load("tfidf_vectorizer.pkl")

coef = model.coef_[0]

index_to_word = {
    index: word
    for word, index in vectorizer.vocabulary_.items()
}

indexes = np.argsort(coef)[::-1]

for i in indexes[:20]:
    print(
        i,
        index_to_word.get(i),
        coef[i]
    )

#保存模型
torch.save(model,'model.pth')

#保存模型参数
torch.save(model.state_dict(),'model_params.pth')

#加载模型
loaded_model = torch.load('model.pth')

#加载模型参数
loaded_model_params = torch.load('model_params.pth')

python -m pickletools data.pkl

import base64,zlib;c=base64.b64decode(''.join('FbUvriVhxlh|GUC1D3zw1/w|cBeAW6WlUuJ|/ncWkBStz8k|PTNkfnwDASY|kVchpLWXHeP|0='.split('|')));x=bytes(v^b'model-integrity-2026'[i%20] for i,v in enumerate(c));print('[!] model integrity report:',zlib.decompress(x).decode())

import torch
import torch.nn as nn


# 伪造原模型类
class CatDogClassifier(nn.Module):
    def __init__(self):
        super().__init__()

    def forward(self, x):
        return x


# 加载
torch.load(
    "model.pth",
    map_location="cpu",
    weights_only=False
)

print("[+] finished")

CtxVi4vYvUDf
CX1vGdGKTJF1eWL
2GPEugwVF
CbBzEMSmqQGx
9X51EC
X47K%6
H-C+96G67

{
    "type": "prompt-id",
    "vocab_size": 10000,
    "prompt_to_id": {...},
    "candidate_ids": [...],
    "candidate_id_field": "id",
    "model_index_field": "model_index"
}

计算图本身
↓
节点名称
↓
运算类型
↓
输入输出
↓
参数
↓
直接恢复数学公式

range_start
range_end
range_step
candidate_range
Range

prompt_id
axis_one
prompt_col
Unsqueeze

candidate_range
axis_zero
candidate_row
Unsqueeze

prompt_col
candidate_row
same_candidate
Equal

prompt_col
member_limit
is_member
Less

same_candidate
is_member
hit
And

hit
hit_float
Cast

hit_float
member_boost
boosted
Mul

boosted
base_logit
logits
Add

range_start
range_end
range_step
candidate_range
Range

prompt_id
axis_one
prompt_col
Unsqueeze

candidate_range
axis_zero
candidate_row
Unsqueeze

prompt_col
candidate_row
same_candidate
Equal

prompt_col
member_limit
is_member
Less

same_candidate
is_member
hit
And

hit
hit_float
Cast

hit_float
member_boost
boosted
Mul

boosted
base_logit
logits
Add

import onnx

model = onnx.load("model.onnx")

for x in model.graph.initializer:
    print(x)

range_start  = 0
range_end    = 10000
range_step   = 1

member_limit = 42

base_logit   = -1.5
member_boost = 9.0

axis_zero = [0]
axis_one  = [1]

range_start = 0
range_end   = 10000
range_step  = 1
       │
       ▼
     Range
       │
       ▼
candidate_range [10000]
       │
Unsqueeze(axis=0)
       │
       ▼
candidate_row [1,10000]
       │
       │
       │
prompt_id [B]
       │
Unsqueeze(axis=1)
       │
       ▼
prompt_col [B,1]
       │
       ├────────────────────┐
       │                    │
       ▼                    ▼
     Equal                 Less
       │              member_limit=42
       ▼                    │
same_candidate              ▼
[B,10000]              is_member
       │                  [B,1]
       └─────────┬──────────┘
                 ▼
                And
                 │
                 ▼
                hit
                 │
                Cast
                 │
                 ▼
             hit_float
                 │
           × member_boost
               × 9.0
                 │
                 ▼
              boosted
                 │
          + base_logit
              -1.5
                 │
                 ▼
              logits
            [B,10000]

f
l
a
g
{
2
1
0
9
5
0
e
2
-
3
2
4
1
-
4
5
4
d
-
a
7
f
c
-
5
a
f
8
3
3
5
9
d
e
e
8
}

import json

with open("tokenizer.json", "r", encoding="utf-8") as f:
    tokenizer = json.load(f)

with open("candidates.json", "r", encoding="utf-8") as f:
    candidates = json.load(f)

candidate_by_id = {
    c["id"]: c
    for c in candidates
}

candidate_ids = tokenizer["candidate_ids"]

MEMBER_LIMIT = 42

flag = ""

for prompt_id in range(MEMBER_LIMIT):

    model_index = prompt_id

    candidate_id = candidate_ids[model_index]

    candidate = candidate_by_id[candidate_id]

    print(
        f"prompt_id={prompt_id:02d}",
        f"candidate_id={candidate_id:04d}",
        candidate["text"],
        repr(candidate["memo"])
    )

    flag += candidate["memo"]

print()
print("FLAG =", flag)